dsh-ssh-tui 0.8.1 → 0.8.2

package/lib/types/tui.d.ts

@@ -19,6 +19,7 @@ import type { Agent, ModelSelection, ModelSelectionRef } from '@deepseek-ai/dsh-
 import type { Context } from '@deepseek-ai/cordis';
 import { type LlmCallConfig } from '@deepseek-ai/dsh-llm';
 import { SessionId, type SessionEvent } from '@deepseek-ai/dsh-session';
+import { auditQuestionPrimaries, type RepresentationAudit } from './representation.js';
 import type { SubagentRunEndInfo, SubagentRunInfo } from '@deepseek-ai/dsh-subagent';
 import { type TerminalCapabilities } from './terminal-caps.js';
 import { type SessionRoute } from './session-route.js';
@@ -29,8 +30,8 @@ import type { CollapsibleBlock, DisconnectPolicyName, Row } from './transcript-t
 import { paintedLinkHits } from './term-text.js';
 export type { CollapsibleBlock, DisplayKind, DisconnectPolicyName, PlanTodoItem, Row, SubagentLogEntry, ToolDiffHunk, } from './transcript-types.js';
 export { clipAnsiToWidth, cursorVisualPosition, displayWidth, foldInputView, hrefAtColumn, osc52Clipboard, osc8Enabled, paintedLinkHits, fmtElapsedCompact, padAnsiToWidth, padToWidth, renderMarkdownLines, repeatToWidth, shimmerText, truncateToWidth, visibleWidth, waitCardCopy, waitSummaryFromReasoning, wrapWaitDetails, } from './term-text.js';
-export { captureHangupSignals, composePaintOutput, detectSshSession, formatLinkQualityChip, ignoreFurtherHangupSignals, isEscapePrefix, findCursorPositionReply, isHangupErrno, linkQualityOf, linkSignalPips, paintIntervalForRtt, paintLinkLabel, parseCursorPositionReply, pickerWindowStart, probeTerminalRttMs, releaseHangupSignals, resolvePaintIntervalMs, waitUntilIdleOrTimeout, writeBootSplash, type LinkQuality, type PaintLinkKind, } from './paint.js';
-export { CONTEXT_IDLE_COMPACT_RATIO, CONTEXT_PRESSURE_DANGER_RATIO, CONTEXT_PRESSURE_WARN_RATIO, CONTEXT_RING_EMPTY, CONTEXT_RING_SEGMENTS, contextPressureAlertText, contextPressureRingColor, contextPressureUsedTokens, contextPressureView, describeProviderRoute, dropFooterQuotaPlanName, fitFooterStatsLine, fitFooterStatusLine, footerActivity, footerIdentityParts, footerStatsGroups, footerSubagentForeign, paintFooterSubagentChip, formatContextPressureChip, formatContextPressureRing, formatContextPressureStatusLine, formatDuration, formatFooterQuota, formatQuotaBar, formatQuotaUnknown, formatStatusReport, providerHasQuotaSurface, quotaWindowTag, shortModelName, shortQuotaPlanName, formatTokens, formatTokensPerSecond, parseContextPressure, promptPressureTokens, providerShortCode, providerUsesLocalOAuth, shouldIdleAutoCompact, subagentRouteLabel, type ContextPressureSample, type ContextPressureView, type FooterActivityKind, type FooterStatsInput, type FooterStatusInput, type StatusReportInput, } from './footer.js';
+export { captureHangupSignals, composePaintOutput, detectSshSession, formatLinkQualityChip, ignoreFurtherHangupSignals, isEscapePrefix, findCursorPositionReply, isHangupErrno, linkQualityOf, linkRedrawBudgetMs, linkSignalPips, paintIntervalForRtt, paintLinkLabel, parseCursorPositionReply, pickerWindowStart, probeTerminalRttMs, releaseHangupSignals, resolvePaintIntervalMs, waitUntilIdleOrTimeout, writeBootSplash, type LinkQuality, type PaintLinkKind, } from './paint.js';
+export { CONTEXT_IDLE_COMPACT_RATIO, CONTEXT_PRESSURE_DANGER_RATIO, CONTEXT_PRESSURE_WARN_RATIO, CONTEXT_RING_EMPTY, CONTEXT_RING_SEGMENTS, contextPressureAlertText, contextPressureRingColor, contextPressureUsedTokens, contextPressureView, describeProviderRoute, dropFooterQuotaPlanName, fitFooterStatsLine, fitFooterStatusLine, footerActivity, footerIdentityParts, footerStatsGroups, footerSubagentForeign, paintFooterSubagentChip, formatContextPressureChip, formatContextPressureRing, formatContextPressureStatusLine, formatDuration, formatFooterQuota, formatQuotaBar, formatQuotaUnknown, formatStatusReport, formatStatusThroughput, formatStatusStats, providerHasQuotaSurface, quotaWindowTag, runtimeStrip, shortModelName, shortQuotaPlanName, formatTokens, formatTokensPerSecond, parseContextPressure, promptPressureTokens, providerShortCode, providerUsesLocalOAuth, shouldIdleAutoCompact, subagentRouteLabel, type ContextPressureSample, type ContextPressureView, type FooterActivityKind, type FooterStatsInput, type FooterStatusInput, type StatusReportInput, } from './footer.js';
 export { commandCodePeriodStart, commandCodeSourceFor, crossedQuotaThresholds, formatAccountBalance, formatFooterBalance, formatOpenCodeGoUsage, formatQuotaSnapshot, formatQuotaStatusLine, joinUrl, openCodeSourceFor, parseCommandCodeQuota, parseDeepSeekBalance, parseOpenAiCompatibleBalance, parseOpenCodeGoQuota, parseSuperGrokBilling, preferredQuotaWindow, quotaAlertText, quotaRefreshEverySteps, quotaRefreshEveryTurns, remainingPercentFromUsed, tightestQuotaWindow, type AccountBalanceLine, type AccountBalanceSnapshot, type CommandCodeSource, type OpenCodeFlavor, type OpenCodeSource, type QuotaPeriod, type QuotaSnapshot, type QuotaWindow, } from './quota.js';
 export { commandAcceptsAttachments, forEachSessionEvent, isTokenDeltaChunk, listPersistenceHeaders, inspectPersistenceSession, sessionEvents, settingsNamespace, streamChunkOf, streamFirstTokenTime, streamFrameAttemptId, streamFrameOwner, } from './dsh-compat.js';
 export { applyTurnEndToPlan, askSummary, cardCategoryOf, compactionHeaderText, formatCompactCommandError, isPromptInjectionMessage, matchTranscriptRows, parseFindQuery, parsePlanTodos, planCloseNudgeText, planDockNote, planIsLive, planTitleFromMarkdown, planTurnLeftOpen, promptInjectionSources, promptInjectionTitle, buildSubagentHeader, clipSubagentActivity, describeSubagentFailure, subagentChipSummary, subagentDisplayName, subagentInspectLines, subagentRowFromSpawnTool, foldSubagentUserLog, todoProgressLabel, todoSummary, type CardCategory, } from './plan.js';
@@ -137,6 +138,14 @@ export interface TuiController {
      */
     sessionHadUserInput(): boolean;
 }
+/**
+ * `DSH_TUI_FEEDBACK_MS` — how long that is, in milliseconds.
+ *
+ * `0` is the pre-0.8.2 behaviour and a legitimate preference: keep an acknowledgement
+ * or a warning until the reader submits something. Anything unreadable or negative
+ * falls back to the default rather than to a surprise.
+ */
+export declare function resolveFeedbackTtlMs(env?: NodeJS.ProcessEnv): number;
 export type WorkspaceView = 'detailed' | 'compact';
 /**
  * One row the card cursor can land on.
@@ -227,12 +236,130 @@ export declare class SshTui {
     private historyDraft;
     private status;
     private dialog;
+    /**
+     * What the open dialog *means*, which its shape cannot say: `/model` and
+     * `ask_user_question` are both `questions` dialogs, and only one of them means
+     * the agent is waiting for a person. Declared by whoever opens the dialog.
+     */
+    private dialogRole;
     private readonly dialogQueue;
     private onboardingCompletion;
     private dirty;
     private disposed;
     private exiting;
     private hangingUp;
+    /** How long the last frame took to compose, for the resize pacing below. */
+    private lastPaintCostMs;
+    private resizeLastEventAt;
+    private resizeLastPaintAt;
+    private resizePaintTimer;
+    /**
+     * Whether a resize frame is currently rendering only the transcript's tail
+     * (see {@link narrowToResizeTail}), so the drag's last geometry can be painted
+     * whole.
+     */
+    private resizeTailNarrowed;
+    /**
+     * A resize arrived: paint the size the window is *at*, not every size it
+     * passed through.
+     *
+     * Dragging an edge emits an event every few milliseconds, and each one used to
+     * get a synchronous full repaint — on a long transcript that is ~100 ms of
+     * rendering per event, so a drag queued seconds of work and the screen trailed
+     * the pointer. Nothing about an intermediate geometry is worth a frame: the
+     * reader cannot use it and the next event invalidates it. Painting the *first*
+     * event of a burst is no better, because that geometry is stale by the time the
+     * frame is composed and it costs the frame that is actually wanted.
+     *
+     * So the frame has a deadline, recomputed on every event:
+     *
+     * - {@link RESIZE_SETTLE_MS} after the newest event (the size has stopped
+     *   moving, so this is the geometry the user is looking at), and
+     * - at the latest one {@link resizeBudgetMs} after the last frame, so a drag
+     *   that never pauses still shows the chrome following the pointer.
+     *
+     * Whichever comes first wins, and the frame is composed from the terminal's
+     * size at the moment it runs — so a newer geometry can never be painted after
+     * an older one; the older one is simply never painted.
+     */
+    private requestResizePaint;
+    /**
+     * Whether the previous *drag* frame is still on its way to the terminal.
+     *
+     * A drag frame is not a token batch: the reader is moving the edge and watching
+     * for the screen to agree with it, so a frame composed now would be superseded
+     * before it landed. What matters is the *queue*, not the pipe's absolute
+     * capacity — measured on a byte-rate-limited consumer, a drag toward a wider
+     * window is the case that hurts, because a frame's size is proportional to the
+     * width: every frame is bigger than the last while the terminal drains at a
+     * fixed rate, the backlog compounds, and the screen keeps moving for tens of
+     * milliseconds after the pointer has stopped (30–44 ms measured, against 0–10 ms
+     * for the shrinking direction).
+     *
+     * So the threshold is one frame, not a fixed 32 KB. That constant is right for
+     * the cadence path, where the question is "is this link slow"; here the question
+     * is "would this frame be a stale geometry queued behind a live one", and the
+     * answer is yes as soon as the last one has not been accepted — however small
+     * both frames are. The named constant stays as the floor, so a long session's
+     * frames can queue a little rather than starving the drag of feedback.
+     */
+    private resizeWireBehind;
+    /** Bytes the last frame carried, whoever owns the wire (see above). */
+    private lastFrameBytes;
+    private pendingBytes;
+    /**
+     * Cap what a resize frame re-renders, and remember that the frame is a
+     * compromise so the drag's last geometry can be painted whole.
+     *
+     * Both matters, and they are different matters: the cap is what keeps the
+     * event loop free while the pointer moves (see
+     * {@link RESIZE_TAIL_MIN_ROWS}), and the remembered flag is what stops the
+     * compromise from *becoming* the screen — the moment the drag pauses, the
+     * transcript is painted in full again at the settled width.
+     *
+     * A scroll position is left alone: a reader who has scrolled back is looking
+     * at rows the tail does not contain, and moving the view under them would be a
+     * bigger lie than a slower frame. `paintTailBudget` already refuses to fold
+     * anything while `scrollOffset > 0` for the same reason.
+     */
+    private narrowToResizeTail;
+    /**
+     * Undo {@link narrowToResizeTail}: the drag has settled, so the frame that is
+     * about to be painted must be the whole transcript at the final width.
+     */
+    private widenPastResizeTail;
+    /**
+     * The longest a resize frame may wait when the wire cannot take another one yet.
+     *
+     * This is a *ceiling*, not a rate: the normal case paints at once (see
+     * {@link requestResizePaint}), and this only decides how often a link that is
+     * genuinely behind is asked again — the previous frame has not drained, so the
+     * next one would be a stale geometry queued behind a live one. Two costs feed it:
+     *
+     * - **composing** a frame — measured (`lastPaintCostMs`): a short transcript is a
+     *   few milliseconds and a long one is a hundred, and repainting faster than that
+     *   starves the event loop that has to receive the next resize;
+     * - **delivering** one on a link whose speed is unknown (see
+     *   {@link linkRedrawBudgetMs}: only an unprobed link falls back to a slow
+     *   budget, because there the interval in force is a number nobody measured).
+     *
+     * A probed link does not need the second term: the backlog check above already
+     * says whether it is keeping up, and pacing it from the round trip as well would
+     * put the artificial delay back that this function exists to avoid.
+     */
+    private resizeBudgetMs;
+    /**
+     * Whether a resize is holding the frame.
+     *
+     * While a deadline is armed the burst is collapsing, and the cadence timer must
+     * not paint on its own: it fires on the paint interval, which is *shorter* than
+     * the budget a heavy session needs, so leaving both flushers live put the frame
+     * count back near one per event — the cost this exists to remove. Content that
+     * changes mid-drag waits at most one budget.
+     */
+    private resizeBurstOpen;
+    /** (Re)arm the frame's deadline. Every event pushes it out. */
+    private armResizePaint;
     private readonly onDirectResize;
     private readonly headlessDisplay;
     private disconnectPolicy;
@@ -377,9 +504,33 @@ export declare class SshTui {
     private liveStreamOwner;
     /** Live events parked while the (yielding) history replay holds the floor. */
     private replayQueue;
+    /**
+     * True while the durable log is still being read into the transcript.
+     *
+     * Frames are not composed during it (see `paint`): a window anchored to a session
+     * that is still growing is the rolling resume this flag exists to prevent.
+     */
+    private loadingHistory;
+    /**
+     * A relay attached while the log was still being read, so the screen entry it
+     * asks for has not been written yet (see `attachRelayDisplay` and `paint`).
+     */
+    private screenEntryPending;
     /** A relay claimed the display while a hangup was still cancelling/flushing. */
     private reattachedDuringHangup;
     private scrollOffset;
+    /**
+     * How many rows `/clear` hid, as a count from the front of `rows`.
+     *
+     * A *view* boundary, not a deletion (AD-4): the rows stay, the session log is
+     * untouched, and a resume shows everything again because this number is Host-local
+     * and never written anywhere. A count is the stable expression here — every new row
+     * is appended at the end, and an update to an old row mutates it in place, so a row
+     * cannot cross the boundary by being updated. When the transcript trims its oldest
+     * rows the count is decremented with them, which keeps the boundary on the same
+     * semantic row.
+     */
+    private clearedRows;
     private readonly clickableRows;
     /**
      * The transcript as painted, for free-form selection. Only the lines that came
@@ -389,6 +540,86 @@ export declare class SshTui {
     private selectableLines;
     /** Screen row (1-based) of the first transcript line in the last frame. */
     private transcriptTopScreenY;
+    /**
+     * The footer echo: the last thing this Host confirmed to the reader.
+     *
+     * Host-local and deliberately not history (AD-13): "theme switched" is an
+     * acknowledgement, not a fact about the session. It lives in the footer's own row
+     * as the lowest-priority chip, is replaced by the next echo, and leaves the row
+     * again when the reader submits — or after `feedbackTtlMs`, whichever comes first.
+     * A detach keeps it (the Host never died); a resume does not restore it (it was
+     * never in the log).
+     */
+    private footerEcho;
+    /**
+     * The ephemeral notice: feedback that needs reading now, and is not history.
+     *
+     * A failed command, an operational warning — messages with too much in them for a
+     * footer chip. It takes the telemetry row for its lifetime: no geometry change, no
+     * content hidden, always visible. It does not steal input, and the next notice
+     * replaces it while the next submit (or its own expiry) clears it. No NotificationManager: one field,
+     * one row.
+     */
+    private notice;
+    /**
+     * The Screen that is up, if any. At most one, and never a dialog.
+     *
+     * A Screen replaces the workspace rather than borrowing rows from it, so it is
+     * deliberately *not* part of `dialog`/`dialogQueue`: a queued question cannot
+     * open behind a report, and a report cannot swallow a question. Nothing else in
+     * this class needs to know which Screen it is — `paintScreen` renders whatever
+     * state is here, and every key gate reads this one field (B2.1).
+     */
+    private screen;
+    /**
+     * A Screen's own action Surface (the doctor confirmation).
+     *
+     * It exists so the channel stays separated in both directions: while a Screen is
+     * up, a confirmation it needs must not enter the workspace queue, and a
+     * workspace Surface that arrives meanwhile must not be consumed by the Screen
+     * (AD-3). At most one, resolved by the Screen that opened it.
+     */
+    private screenSurface;
+    /** Resolver for `screenSurface`, so closing it always settles its promise. */
+    private screenSurfaceResolve;
+    /**
+     * Whether the next Screen frame must establish the whole picture.
+     *
+     * True when a Screen opens and after a reattach: the terminal is empty or holds
+     * an unrelated frame, and one full paint is both cheaper and less surprising than
+     * a partial one against unknown contents. Every later frame is incremental.
+     */
+    private screenNeedsFullPaint;
+    /** The strip's last painted text, so an unchanged strip is not re-sent. */
+    private lastScreenStrip;
+    /**
+     * The rows the transient layer covers, 1-based and inclusive of `top`..`top+rows-1`.
+     *
+     * The layer is drawn over the transcript, so anything the frame registers as
+     * clickable or selectable below this line is a target the reader cannot see.
+     * The mouse handlers already refuse to start while a surface owns the keyboard;
+     * this makes the maps themselves honest, so a later change cannot introduce
+     * click-through by forgetting that gate. B1.2 widened what the layer carries —
+     * a question and a control-plane picker both land here — but not what it means:
+     * covered rows are hidden, never re-defined, and the composer's boundary is
+     * always below the last of them.
+     */
+    private interactionRegion;
+    /**
+     * The rows the live tail covers, 1-based, same convention as the layer above.
+     *
+     * The tail is a *projection* of runtime state (streaming text, the wait card),
+     * not history: it is drawn over the bottom of the window and owns no source row.
+     * Rows under it are hidden, so — exactly like the interaction layer — nothing
+     * behind them may stay a click, drop or link target.
+     */
+    private liveTailRegion;
+    /**
+     * The interaction row that must stay visible when the layer has to window
+     * itself (the highlighted option): on a short terminal the list is scrolled to
+     * the selection instead of being clipped at the bottom.
+     */
+    private dialogFocusLine;
     /** Where a drag started; the run it belongs to decides what can be selected. */
     private mouseAnchor;
     /**
@@ -408,8 +639,32 @@ export declare class SshTui {
     /** Screen-row → OSC 8 hits from the last paint (tests). */
     get linkHitsByRow(): Map<number, ReturnType<typeof paintedLinkHits>>;
     private streamingReasoning;
+    /**
+     * The reader's expansion choice for the live thinking card, for this turn.
+     *
+     * A turn thinks in phases: think, call a tool, think again. Each phase used to
+     * start a fresh collapsed card, so a reader who had just expanded the card being
+     * written watched it fold itself shut at the next phase — "the thinking card
+     * cannot be expanded" as the reader experiences it, even though each individual
+     * card could be. The choice is the reader's, it belongs to the turn, and
+     * `turn/start` is the only thing that resets it.
+     */
+    private reasoningExpandedChoice;
     private escapeBuffer;
     private escapeTimer;
+    /**
+     * How long an acknowledgement or a warning stays on the chrome.
+     *
+     * B2.3b kept them until the next submit, with no timer, so a reader who came back
+     * after a while still saw what happened. Measured against the actual use — a
+     * "copied 412 characters" chip and a "applies at the next step" notice — that is
+     * the wrong trade: the reader has read them within seconds, and until they type
+     * something the row is occupied by a sentence about the past instead of the
+     * telemetry it replaced. They now expire on their own (and a submit still clears
+     * them at once).
+     */
+    private feedbackTtlMs;
+    private feedbackTimer;
     /**
      * Cursor-position replies removed from the relay's stdin stream. A launcher
      * from an older release (or a reply that raced its own probe) would otherwise
@@ -457,7 +712,13 @@ export declare class SshTui {
      * mean touching the filesystem on every repaint.
      */
     private rosterMissing;
-    /** Screen row of the health chip in the status strip, for click-to-doctor. */
+    /**
+     * Screen row of the install warning, for click-to-doctor.
+     *
+     * It is a chip on the status row like any other — that row is the last line of
+     * the frame, so its index is the frame's last row — and clicking anywhere on it
+     * opens the report that explains it.
+     */
     private healthChipRow;
     /** How much colour this terminal can take (see `color-depth`). */
     private readonly colorDepth;
@@ -479,6 +740,44 @@ export declare class SshTui {
     /** Approvals refused because nobody could confirm them (a subset of denials). */
     private detachedDeniedCount;
     /** Questions waiting for a display right now — their cards do not exist yet. */
+    /**
+     * The questions each `ask_user_question` call recorded, and the cards drawn for
+     * them.
+     *
+     * Keyed by call *and* question id: one call carries a batch, and two calls may
+     * reuse a question id. The card is the presentation only — the Session's
+     * projection is what says whether a question is still answerable and what it was
+     * answered with, so a replayed session draws the same card a lived one did.
+     */
+    private readonly askedByCall;
+    private readonly questionCards;
+    /**
+     * Every plan-relevant durable event of this session, in order (B2.5).
+     *
+     * The plan artifact is a *projection* of these, so nothing here is plan state: the
+     * fold decides, and the transcript row, the dock and the review Surface all read
+     * the result. `live` marks the events that arrived from the running Host, because
+     * only they can carry an unanswered review (a resumed process never finishes one).
+     */
+    private planEvents;
+    /** The folded artifacts. Recomputed whenever `planEvents` grows. */
+    private planArtifacts;
+    /** The state last *said* in the transcript per artifact, so a transition is one row. */
+    private readonly planAnnounced;
+    /**
+     * The approvals the Session log has recorded, by the Harness's own `id`.
+     *
+     * `approval/asked` states the request (and the tool call it guards),
+     * `approval/decided` states the outcome, and the two are joined here so a
+     * decision that arrives before its row exists — or a row that arrives after both
+     * — still lands on the same card. Nothing is written back: the log is the
+     * Harness's, and this plugin keeps no approval history of its own (B2.4).
+     */
+    private readonly approvalAsked;
+    /** Approvals resolved before their tool card existed, waiting for it. */
+    private readonly pendingApprovalByCall;
+    /** Cards that exist only because a live request opened them (no durable call id). */
+    private liveQuestionSeq;
     private queuedQuestions;
     /** When the current detached wait began, so the reconnect can say how long. */
     private questionWaitSince;
@@ -493,6 +792,13 @@ export declare class SshTui {
      */
     private sshSession;
     private paintProbed;
+    /**
+     * Where {@link paintIntervalMs} came from: a measured round trip, an explicit
+     * `DSH_TUI_PAINT_MS`, or a local TTY's constant. Only the *unprobed SSH* case is
+     * an unknown link, and only that case falls back to
+     * {@link RESIZE_UNKNOWN_LINK_BUDGET_MS}.
+     */
+    private paintCadence;
     private paintRttMs;
     /** The last few measured round-trips; the chip and the budget use their median. */
     private paintRttHistory;
@@ -631,6 +937,16 @@ export declare class SshTui {
      * user wrote is never touched, and the previous file is kept as a backup.
      */
     private repairProfilePatch;
+    /**
+     * Where an action's outcome is reported: the Screen that asked, or a row.
+     *
+     * A Screen's own action is answered *on the Screen* — the reader is looking at it,
+     * and the row it would otherwise push lands behind their own view. With no Screen
+     * up (the same code path serves `/fix`), the answer is an ordinary row.
+     */
+    private resultChannel;
+    /** Report a Screen action's outcome, or fall back to a row. */
+    private reportActionResult;
     /** Human-facing exit with goodbye and flush; called from key handling. */
     requestExit(code: number): Promise<void>;
     /**
@@ -691,9 +1007,57 @@ export declare class SshTui {
     private toolCardSummary;
     private mergeIntoToolCard;
     private findToolRowByCallId;
+    /**
+     * The approval state of one tool call (B2.4).
+     *
+     * Approval has no row of its own: it is a field of the card for the call it
+     * guarded. A decision can arrive before the card does (a `tool/result`-only
+     * fragment, a resumed log read out of order), so an unresolved call id is kept
+     * until its row appears rather than dropped.
+     * @param callId - the tool call the approval belongs to.
+     * @param next - the fact being applied, or undefined to read it back.
+     * @returns the field after the merge.
+     */
+    private setToolApproval;
+    /**
+     * The weakest approval reading there is, and the only one allowed to be weak.
+     *
+     * A log from before the Harness recorded its audit pair still says *something*
+     * about a refused tool: the tool never ran, and the reason is the Harness's own
+     * sentence for an approval that came back rejected or cancelled. That is a
+     * reading, not a decision, so it is filed as `inferred` — and it can only ever
+     * produce `rejected`/`unknown`, never `approved`: a tool that ran proves nothing,
+     * because a tool nobody had to approve runs too.
+     *
+     * Anything already known from a stronger source wins, which is also what keeps a
+     * live decision from being rewritten by the sentence it produced.
+     * @param row - the card that just settled.
+     * @param message - the tool result's message.
+     * @param error - the result's error, when it has one.
+     */
+    private inferApprovalFromResult;
+    /** Hand a card the approval that was resolved before the card existed. */
+    private adoptPendingApproval;
     private findMergeableToolRow;
     /** Append one transcript row, bounding memory on long sessions. */
+    /**
+     * The only way a line enters the transcript.
+     *
+     * It takes a `Representation` — a row *plus* the policy that produced it — and not
+     * a `Row`, so a creation site cannot skip the classification: a bare row is a type
+     * error, and a source id with no policy is one too (`RepresentationSource` is the
+     * policy table's keys). The policy is copied onto the row here, which is what makes
+     * a real transcript auditable afterwards: `auditRepresentations(this.rows)` can
+     * then answer how many lines are history and how many are the Host's own voice.
+     *
+     * A JavaScript caller (a test fixture, an embedder) can still hand over something
+     * that is not a representation. That case is *recorded*, not defaulted: the row is
+     * pushed with no metadata and `unclassifiedRepresentations` counts it, so the audit
+     * fails loudly instead of quietly calling an unknown line durable.
+     */
     private pushRow;
+    /** Append one classified row to the transcript (the `transcript` destination). */
+    private appendRow;
     /** Append one event, holding it until a display can carry it. */
     private writeLineMode;
     /** Hand the held lines to the display that just attached. */
@@ -713,6 +1077,13 @@ export declare class SshTui {
      * painted, so anything not in the rows is appended.
      */
     private focusRing;
+    /**
+     * The live thinking block, created on first use.
+     *
+     * Expanded or not is the reader's choice for the turn, not this frame's: see
+     * `reasoningExpandedChoice`.
+     */
+    private liveThinkingBlock;
     private spinnerFrame;
     /**
      * Codex wait card: shown while the turn is running. The live thinking
@@ -729,14 +1100,66 @@ export declare class SshTui {
     /** Courtesy name for a child session; never the raw session hash. */
     private subagentNameFor;
     private findLivePlanRow;
+    /**
+     * Keep the plan log, and re-fold when it grew.
+     *
+     * Only the events the fold reads are kept (B2.5). They are rare — a plan mode
+     * switch, a todo snapshot, a review — so a whole re-fold per plan event stays
+     * trivial, and it keeps the projection a *pure function of the log* rather than a
+     * running tally that could drift from one.
+     */
+    private recordPlanEvent;
+    /**
+     * The projection, onto the rows three readers share.
+     *
+     * One artifact, one row: the row is the artifact's *reference* in the transcript
+     * (its lifecycle summary and, when expanded, its steps), the dock paints the live
+     * one, and the review Surface is the dialog. None of the three keeps plan state of
+     * its own (AD-15): they all read what this fold decided.
+     */
+    private syncPlanArtifacts;
+    /** The row that stands for one artifact, if it has been drawn yet. */
+    private planRowFor;
+    /** The artifact a docked row belongs to, when the workspace should show one. */
+    private dockedPlanRow;
+    private createPlanRow;
+    /**
+     * Say one lifecycle transition, once.
+     *
+     * The transcript keeps the artifact's *lifecycle*: entering plan mode, a review's
+     * answer, leaving the mode. It does not keep a second copy of the plan body — that
+     * is the artifact's (the dock while it is live, the review Surface while it is under
+     * review, this row's overlay afterwards) — and a transition is never announced
+     * twice, which is what makes the fold idempotent under a re-`sync`.
+     */
+    private announcePlanTransition;
     /** Older / finished plans stay in the scrolling transcript. */
     private archiveStalePlans;
-    private upsertPlanRow;
+    /**
+     * There used to be a second plan-row writer here (`upsertPlanRow`).
+     *
+     * B2.5 moved every plan row onto the artifact fold — one artifact, one row, and
+     * `syncPlanArtifacts` is the only place a plan row is created — which left this
+     * one with no caller. The B2 final audit removed it rather than leave a second
+     * truth in the file for someone to find and call.
+     */
     /** Whether the live plan strip should occupy the workspace footer. */
     private shouldDockPlan;
     /** Send the leftover-todo nudge only from true idle, so /compact is not blocked. */
     private flushPlanCloseNudge;
     /** Compact web-style plan strip pinned above the input, not in the transcript. */
+    /**
+     * The live region's runtime lines: the thinking card, the streamed text, the
+     * wait card — in that order.
+     *
+     * Built before the window is computed, because the region *reserves* rows now:
+     * `paint` needs its height before it can size the transcript. `waitStart` is
+     * where the wait card begins, which is where the compact view splices the
+     * running burst (that is where the transcript paints it for a settled reply).
+     * `thinkingRows` is how many lines the live thinking card owns, so a click on
+     * them reaches the card.
+     */
+    private runtimeTailLines;
     private paintPlanDock;
     /**
      * One diff line with its changed characters in reverse video.
@@ -758,8 +1181,133 @@ export declare class SshTui {
      */
     private styleColumnedLine;
     private paintToolBodyLine;
+    /**
+     * The representations this transcript is made of (B2.3a's audit artifact).
+     *
+     * Reads the policy off the rows themselves, so it reports what is really in the
+     * transcript rather than what the table says should be — including anything that
+     * arrived unclassified.
+     */
+    representationAudit(): RepresentationAudit;
+    /**
+     * The ask-user half of the audit: one semantic question, one primary row.
+     *
+     * Read off the real transcript rather than declared, because the invariant is
+     * about what a reader can see: a call with both a question card and a generic
+     * tool card is two primaries for one event, and the count is what catches a
+     * regression (B2.4).
+     */
+    questionPrimaryAudit(): ReturnType<typeof auditQuestionPrimaries>;
+    /**
+     * Drop an acknowledgement or a warning whose time is up.
+     *
+     * Called before a frame is built and by the expiry timer, so every reader — the
+     * footer, the Screen strip, `/diag` and the tests — sees the same thing at the same
+     * moment: the row is the session's again once the sentence has been readable.
+     */
+    private expireFeedback;
+    /**
+     * Repaint when the newest feedback expires, so the row goes back by itself.
+     *
+     * Unref'd: this timer exists to refresh a UI that is already running, and a Host
+     * with nothing else pending (no window attached, no turn) may exit instead — the
+     * expiry is evaluated against the timestamp on the next frame anyway, so nothing
+     * depends on the callback being reached.
+     */
+    private armFeedbackExpiry;
+    /** The footer echo the reader can see right now, if any (a test/`/diag` seam). */
+    currentFooterEcho(): string | undefined;
+    /** The ephemeral notice the reader can see right now, if any. */
+    currentNotice(): string | undefined;
+    /** The audit as text, for the dev script and for `/diag`-style reporting. */
+    formatRepresentationAudit(): string;
+    /** The rows the reader can see: everything after the `/clear` cutoff. */
+    private visibleRows;
     private workspaceRowsFor;
-    private paintInspectOverlay;
+    /**
+     * Open one report as a Screen.
+     *
+     * A report is not narrative: it cannot be rebuilt from the session log (it is not
+     * a session event), so leaving it in the transcript meant the reader scrolled
+     * through something that would vanish on the next resume, pushed the real history
+     * out of the window (`/help` moved the anchor 53 rows, measured) and cost a full
+     * clear per invocation. It is ephemeral by design: a Screen, gone when dismissed,
+     * never written to the log (AD-7).
+     *
+     * Only the *successful* path comes here. A command that fails still writes an
+     * `error` row: a failure is part of the session's story and has to outlive the
+     * visit.
+     */
+    private openReport;
+    /**
+     * Open a Screen: it replaces the workspace for as long as it is up.
+     *
+     * The workspace's own state — the transcript window, `scrollOffset`, the focused
+     * card, `/find` hits, the composer draft, and whatever Surface is queued behind
+     * it — is neither touched here nor rebuilt on the way out. A Screen is a visit,
+     * not a second workspace.
+     */
+    private openScreen;
+    /** Leave the Screen and hand the pixels back to the workspace, as they were. */
+    closeScreen(): void;
+    /**
+     * Ask a confirmation in whichever channel owns the screen.
+     *
+     * A Screen's own action (the doctor repair) needs a human decision, and while a
+     * Screen is up that question belongs to it: it is painted on the Screen's hint
+     * row and settled by the Screen's key handler, so it never enters the workspace
+     * `dialogQueue` and a workspace question waiting there is left untouched (AD-3).
+     * Returns `undefined` when no Screen is up, so the caller uses the ordinary path.
+     */
+    private askScreenConfirm;
+    /** Settle the Screen's own confirmation, if one is up. */
+    private settleScreenConfirm;
+    /**
+     * Paint the Screen that is up: it replaces the workspace entirely.
+     *
+     * A Screen is state (`ScreenState`) plus this renderer, and nothing else: the
+     * same state redraws the same picture, which is what makes a reattach after an
+     * SSH drop ordinary rather than special. Only the *first* frame of a Screen —
+     * opening, a resize, a reattach — clears the screen; scrolling a report repaints
+     * the body rows that actually changed and leaves the title, hint and strip alone.
+     * The previous implementation passed `sizeChanged: true` on every frame, so every
+     * arrow key cost a full clear and a full frame (measured: 2.7 KB per keypress at
+     * 100×20).
+     */
+    private paintScreen;
+    /**
+     * The Screen's bottom hint row: how to leave, where the reader is, how to move.
+     *
+     * Composed in that order so truncation takes the least load-bearing part first:
+     * a reader on a 48-column terminal still sees `全文 12–16/80 · Esc 返回`, while a
+     * wide one also gets the navigation keys. A confirmation owned by the Screen, and
+     * a notice from an action it performed, take the row outright — both are answers
+     * to something the reader just did, and both belong to *this* Screen rather than
+     * to the workspace's dialog queue (AD-3).
+     */
+    private screenHintLine;
+    /**
+     * The setup Screen's rows, built from the wizard's state every frame.
+     *
+     * The order is the contract (B2.6 §8): what this step *is*, then its prose, then the
+     * control the reader acts on, then validation, then the keys. The layout keeps the
+     * last two whatever the height — prose is what gets cut, never the field — and the
+     * secret step renders the key masked, because a Screen is a place other people can
+     * see (B2.6 §4/§8).
+     */
+    private renderSetupBody;
+    /**
+     * Fit prose and controls into whatever rows are left.
+     *
+     * Under height pressure the *prose* is what goes: the field, the notice and the key
+     * hints are how the reader continues, and a setup screen whose only control was cut
+     * away is a dead end (B2.6 §8).
+     */
+    private windowSetupBody;
+    /** Rows the setup body may use: the Screen's own layout, minus the step indicator. */
+    private setupBodyBudget;
+    /** A Screen's body, wrapped for the width it will be shown at. */
+    private renderScreenBody;
     /**
      * Reverse-video (or a `»` in monochrome) on the overlay row that holds the
      * current `/find` needle, matching what the transcript does for the same hit.
@@ -832,20 +1380,83 @@ export declare class SshTui {
     private runFindCommand;
     private stepSearch;
     private paint;
+    /**
+     * The dock line for a terminal with no room for the card.
+     *
+     * `compact` keeps the current step (the one thing a reader acts on) and `minimal`
+     * keeps only the mode and the progress. Both stay one row: the dock is under height
+     * pressure precisely because the workspace is small, and a second row would come out
+     * of the transcript.
+     */
+    private planDockCompactLine;
+    /**
+     * The runtime facts the footer and a Screen's compact strip both report.
+     *
+     * One derivation, two readers. The Screen strip could have read `this.*` for
+     * itself, but then a new activity kind would have to be taught to two assemblers
+     * and the two surfaces could disagree about whether the agent is running — the
+     * second truth source the decision record forbids (AD-8). The two parameters are
+     * the composer's *shape*, the one input that is a property of the frame rather
+     * than of the session; the strip does not read them.
+     */
+    private footerFacts;
+    private paintFrame;
     private workspaceCwd;
     private announceWorkspaceCwd;
     private buildSuggestions;
     private suggestionsVisible;
     private currentProviderId;
     private currentSelectionLabel;
-    /** Compact session stats groups for the first footer row. */
-    private statsText;
+    /**
+     * The session's own telemetry, in the shapes the old status line used.
+     *
+     * Kept because the footer is not the only reader: the numbers a user files a
+     * bug report with (turns, steps, model time, tool time, cache hit, and the
+     * exact per-step decode rate) are still part of the session's public surface,
+     * and this is the accessor `/status` and the tests reach for. The default row
+     * itself no longer shows any of it.
+     */
+    statsText(): string;
+    /**
+     * When the activity the status row is reporting began.
+     *
+     * Each state has its own natural clock, and the row shows whichever one
+     * belongs to the state it is painting: a tool shows how long that tool has
+     * run, a subagent the age of the oldest child, a compaction its card, and a
+     * streaming step the time since its first delta. A state with no honest clock
+     * — plan mode, a goal, a question nobody has answered yet — gets none, so the
+     * chip shows the verb alone rather than borrowing a number that measures
+     * something else.
+     */
+    private footerActivityStartedAt;
+    /**
+     * What the open tool calls are, as one word for the activity chip.
+     *
+     * One call names itself through the transcript's own tool vocabulary
+     * (`toolTitle`, the same table the cards use, so `bash` reads `terminal` in
+     * both places). Several at once get the count instead, because "which one" has
+     * no single answer and a comma-separated list is not a status chip.
+     */
+    private activityToolLabel;
+    private agentStatusRunning;
     /** Refresh the terminal window title (throttled while running). */
     private updateTerminalTitle;
     /** Terminal bell on completion (opt out with DSH_TUI_NO_BELL=1). */
     private playCompletionSignal;
     private render;
     /** Whether the previous frames have not drained yet (slow link, big burst). */
+    /**
+     * Whether the last frame is still on its way to the terminal.
+     *
+     * Two wires, one question. A direct TTY is `stdout`; a relayed session writes
+     * into the display socket, and that socket is the one that knows how much has
+     * not left yet. The relay path used to answer "no, never backlogged", which left
+     * the Host with no way to tell a link that is keeping up from one that is not —
+     * so it paced itself from the measured round trip alone, and a drag on a fast
+     * link waited for a cadence nobody needed.
+     */
+    private outputBacklogged;
+    /** The name the paint path has always used for this question. */
     private stdoutBacklogged;
     /**
      * `/preset`: list, inspect, copy, rename, describe, and delete agent presets.
@@ -963,6 +1574,22 @@ export declare class SshTui {
     private readonly handleError;
     private readonly handleInboxClaimed;
     private readonly handleInboxDiscarded;
+    /**
+     * Say that a message is queued, and hold the notice until it is really submitted.
+     *
+     * The one notice that must outlive its clock: it is the only sign the reader has that
+     * something is waiting, and it stays true until the step claims it — so it lives as
+     * long as the queue does (`noteQueueDrained` clears it), not as long as a timer says.
+     */
+    private showQueuedNotice;
+    /**
+     * The last queued message was claimed (or dropped): the acknowledgement goes with it.
+     *
+     * This is what "until it is really submitted" means — the notice is not about the
+     * keystroke that queued the message, it is about the message still waiting, so it
+     * ends where the waiting does.
+     */
+    private noteQueueDrained;
     private readonly handleDisposed;
     /**
      * One `workspace/changes` event: the files a turn changed.
@@ -1081,9 +1708,107 @@ export declare class SshTui {
      * {@link TUI_SOURCE_KIND}.
      */
     private tellModelApprovalDenied;
+    /**
+     * The card an approval request guards, marked as *being asked*.
+     *
+     * Waiting is a live-only state: it is true while a Host is holding the request
+     * open, and a replay can never claim it (see `approval/asked`). Set here rather
+     * than in the auto path so a manual prompt and an automatic decision both show
+     * the same thing on the card while the decision is being made.
+     * @param request - the pending approval.
+     * @param provenance - who is deciding: a person (`live`) or this plugin (`policy`).
+     */
+    private markApprovalWaiting;
+    /**
+     * Record the decision on the card it guarded.
+     *
+     * `provenance` is the strongest source that produced it: `policy` for a rule, a
+     * cached verdict or a reviewer, `live` for the person at the keyboard. The
+     * Harness's own `approval/decided` event follows this on the same turn and says
+     * strictly less, so `mergeApproval` lets this win (B2.4).
+     */
+    private settleToolApproval;
     readonly handleApproval: (request: ApprovalRequest, _next: () => Promise<ApprovalOutcome>) => Promise<ApprovalOutcome>;
+    /**
+     * Answer a question whose window closed but whose call the Session still holds.
+     *
+     * `ctx.userQuestions.answer(agent, callId, batch)` is the Harness's own channel
+     * for this: it steers a `user-question-reply` message into the agent, and that
+     * message is what closes the question in the projection. Two preconditions come
+     * from the service, not from us — the agent must be the session's live runtime
+     * root, and the question must still be `continued` — so a refusal here is
+     * reported rather than retried.
+     * @param row - the focused question card.
+     * @returns true when the card consumed the key.
+     */
+    private answerContinuedQuestion;
+    /**
+     * The text field a surface borrowed, when the surface needs typed input.
+     *
+     * The composer's draft used to *be* every dialog's text field: a free-text
+     * answer, a setup field and a picker's search all wrote `this.input`. That made
+     * "what does this string mean" depend on which mode happened to be active, and
+     * a paste or a cancelled answer could overwrite the message the reader was
+     * writing. A surface that needs text now gets its own field; the composer keeps
+     * its draft until the composer is the thing being typed into.
+     */
+    private borrowedText;
+    /** Whether this dialog types into a field of its own rather than the composer. */
+    private dialogNeedsText;
+    /** Give a text-needing dialog its own field. The composer draft stays put. */
+    private borrowTextFor;
+    private releaseBorrowedText;
+    /** The text the keyboard is editing: a borrowed field, or the composer draft. */
+    private fieldText;
+    private fieldCursor;
+    /** Write the field the keyboard is editing, wherever it lives. */
+    private setField;
+    /** Insert at the caret of whichever field owns the keyboard. */
+    private insertIntoField;
+    /** One card's key: a call's batch can repeat a question id across calls. */
+    private questionCardKey;
+    /**
+     * The Session's durable question view, when the projection is registered.
+     *
+     * `ctx.sessionProjections` is driven by `@deepseek-ai/dsh-user-questions`, which
+     * folds `tool/call` + `tool/result` (and late replies) into
+     * `{ active, settled }`. Absent in a bare Context — a test, an embedder without
+     * the projection package — which is why every caller here has a live fallback.
+     */
+    private questionProjection;
+    /**
+     * Draw the cards the Session log can account for.
+     *
+     * Called for the events that can change question state, live and replayed alike,
+     * so the two paths produce the same transcript. It never removes a card: a card
+     * is history once it is drawn, and a call the projection cannot see (the legacy
+     * blocking schema, or no projection at all) is the live path's to own.
+     */
+    private syncQuestionRows;
+    /** One durable record onto its card, creating the card the first time. */
+    private applyQuestionRecord;
+    /**
+     * The card for one call's question, created from its structured form if new.
+     *
+     * A **plan review** gets none (B2.5 §7): it is the plan artifact's interaction, not
+     * an ordinary ask, and the artifact already has a row — the same review drawn as
+     * both a question summary and a plan state is the duplicate this round removes. The
+     * Surface (the dialog) is unchanged, and `dsh-plan-mode` identifies the review by the
+     * `exit_plan_mode` call it belongs to, which the projection reads.
+     * @returns the card, or undefined when the question belongs to another artifact.
+     */
+    private ensureQuestionCard;
     readonly handleUserQuestions: (request: AskUserQuestionRequest) => Promise<AskUserQuestionAnswer>;
-    /** Queue one dialog behind an already-open one instead of overwriting it. */
+    /**
+     * Queue one dialog behind an already-open one instead of overwriting it.
+     *
+     * The active surface is never replaced: whoever owns the keyboard keeps it until
+     * it is answered or cancelled, so a picker can never cover a question (and a
+     * question can never silently discard a half-made choice). What priority decides
+     * is the *line*: a task interaction takes the keyboard ahead of a picker that was
+     * already waiting, because someone is blocked on it. Ranks are compared, not
+     * stacked — equal ranks keep arrival order.
+     */
     private openDialog;
     private showNextDialog;
     /**
@@ -1099,8 +1824,16 @@ export declare class SshTui {
     /** Resolve one queued or active confirm from its abort signal. */
     private abortConfirm;
     private openQuestion;
-    /** Open one question dialog and await its answer (cancellation rejects). */
+    /**
+     * Open one control-plane question and await its answer (cancellation rejects).
+     *
+     * Every `/model`-style menu goes through here, which is why the role is
+     * `picker`: the agent is neither waiting nor interrupted by a menu that only
+     * changes the environment.
+     */
     private askQuestion;
+    /** One question dialog with an explicit role, awaited by the caller. */
+    private openQuestionAs;
     /** The stored llm-pi-ai profile for one provider route, when settings provide one. */
     private piAiProviderProfile;
     /**
@@ -1396,11 +2129,57 @@ export declare class SshTui {
     private resolveSuperGrokToken;
     private fetchJson;
     private readonly handleData;
+    /**
+     * One key, handled by the Screen that is up.
+     *
+     * The Screen owns the keyboard completely, so this is also the place that keeps
+     * the workspace's state out of reach: no arrow moves a card behind the Screen, no
+     * page key scrolls the transcript, no print reaches the composer draft. Closing
+     * keys come from `inspectClosesOn`, which is what the overlay always accepted —
+     * plus `q`, which a full-screen report is expected to answer to.
+     */
+    private handleScreenInput;
+    /**
+     * Whether anything human is waiting behind the Screen that is up.
+     *
+     * A Surface cannot open while a Screen owns the screen (it stays in the workspace
+     * queue), so without this the reader would have no way to know that an approval
+     * or a question is waiting for them behind the report — the one thing a Screen
+     * must never hide (AD-8). A question the Session still holds counts too: the agent
+     * is not blocked, but the reader has something to answer.
+     */
+    private screenWaitingWork;
+    /** Rows one PageUp moves a Screen: the body, less one row of context. */
+    private screenPage;
+    /** Scroll a Screen by `up` rows toward the start of its body. */
+    private scrollScreen;
+    private scrollScreenTo;
+    /** The copy key inside a Screen: what the Screen shows is what the reader means. */
+    private copyFromScreen;
     private handleInputText;
     /** Handle one data chunk that may contain bracketed-paste markers. */
     private processPasteChunk;
-    /** Insert pasted text into the input buffer; CR/LF are literal newlines. */
+    /**
+     * Insert pasted text into the field that owns the keyboard; CR/LF are literal
+     * newlines.
+     *
+     * A paste is text input, so it goes through the same ownership question ordinary
+     * typing does: into the composer's draft when the composer owns the keyboard, and
+     * into a borrowed field when a surface that has one does. A surface without a
+     * text field (a confirmation, the inspect overlay) takes no paste at all — the
+     * alternative was writing the composer's hidden draft behind it, which is how a
+     * paste into an approval dialog could silently rewrite the message being written.
+     */
     private handlePasteText;
+    /**
+     * Whether the keys that edit text belong to a field right now.
+     *
+     * The composer always has one; an open surface only has one when it borrowed it
+     * (a free-text answer, a setup field). Everything else — a confirmation, a menu,
+     * the inspect overlay — owns the keyboard without owning text, and those keys
+     * must do nothing rather than reach the draft behind the surface.
+     */
+    private textIsEditable;
     private handlePlainText;
     private handleChar;
     /**
@@ -1442,6 +2221,33 @@ export declare class SshTui {
     private onboardingWantsEndpoint;
     /** Fill the picks' capacities and endpoints from the gateway; never fatal. */
     private enrichOnboardingModels;
+    /** The wizard's field text, from the wizard's own state. */
+    private setupField;
+    /** Replace the wizard's field and caret; the composer is not touched. */
+    private setupSetField;
+    /** Insert into the wizard's field at its caret. */
+    private setupInsert;
+    /** Delete the code point before the wizard's caret. */
+    private setupBackspace;
+    /**
+     * Say something inside the setup Screen.
+     *
+     * Framed mode keeps it on the Screen's own message row — the wizard is a screen,
+     * not history, and a `Step 1 done` transcript would be a record of a flow that
+     * only ever ran once (B2.6 §12/§13). Line mode has no screen to say it on and has
+     * always printed the wizard's messages as text, so it still appends one.
+     */
+    private setupMessage;
+    /**
+     * The setup Screen's key handling: its own field, its own navigation.
+     *
+     * Everything the wizard used to get from the workspace's composer and its
+     * dialog key path is handled here — the caret keys edit the wizard's field, the
+     * arrows move the wizard's pickers, Esc steps back through the picker steps or
+     * abandons the flow, and the confirm step answers itself. A key this does not
+     * consume is *not* forwarded anywhere: a setup screen has no other owner (B2.6 §4).
+     */
+    private handleSetupKey;
     private handleOnboardingChar;
     private advanceOnboarding;
     /**
@@ -1491,6 +2297,8 @@ export declare class SshTui {
     private plainSelectableLines;
     /** Screen row from a mouse report to an index into `selectableLines`. */
     private selectableLineAt;
+    /** The last transcript row the interaction does not cover, or the whole list. */
+    private lastSelectableLine;
     /**
      * Left button pressed. The click itself waits for the release: this may turn
      * into a drag, and a press that never moves must still open a link or toggle
@@ -1505,8 +2313,48 @@ export declare class SshTui {
     private highlightSelection;
     handleMouseClick(y: number, x?: number): void;
     private copyPlainText;
+    /**
+     * `/copy [reply|highlight|error]` — copy plain text to the local clipboard.
+     *
+     * The default is the model's **last reply**, which is what a reader wants on
+     * the clipboard most of the time: the answer they just read, whole, ready to
+     * paste into a report. It used to be "the highlighted card, else the newest
+     * reply", so any card left highlighted (one click on a tool card does it)
+     * silently redirected the copy and the reply became unreachable without
+     * deselecting first. `highlight` is that old rule, now said out loud.
+     */
     copyFocusedCard(arg?: string): boolean;
-    private scrollInspectOrTranscript;
+    /**
+     * The copy key: what the reader is *pointing at*.
+     *
+     * The key and the command are two grammars over the same act, and they differ
+     * in exactly one place: with nothing highlighted the key falls back to the
+     * newest reply (a key that copies nothing reads as a broken key), while
+     * `/copy highlight` says there is nothing highlighted. Inside a Surface the key
+     * is the only way to copy at all: a Screen carries what it shows, and every
+     * other dialog keeps the key inert, exactly as it always was.
+     */
+    private copyKey;
+    /** The newest error or diagnostic row, whole. */
+    private copyErrorRow;
+    /** The highlighted card — or, for the key, the newest reply when none is. */
+    private copyHighlighted;
+    /** The model's last reply: the `/copy` default, and the key's last resort. */
+    private copyLatestReply;
+    /**
+     * Scroll whichever surface the reader is looking at, by `up` lines toward the
+     * earlier content.
+     *
+     * One sign for every caller, because the two surfaces count in opposite
+     * directions: the transcript's `scrollOffset` is the distance *back* from the
+     * newest line, and the overlay's `offset` is the index of its first visible line.
+     * Adding one delta to both — which is what this did — made PgUp and the wheel
+     * scroll the overlay the wrong way, while the arrow keys, which passed their own
+     * inverted sign, were the only ones that felt right. A surface that is not the
+     * inspect overlay owns the keyboard and takes no scroll at all: the transcript
+     * behind a dialog must not move.
+     */
+    private scrollActiveSurface;
     private handleCtrlC;
     private submit;
     private runCommand;
@@ -1514,8 +2362,11 @@ export declare class SshTui {
     private graphemeBefore;
     /** Grapheme cluster containing or following `cursor`. */
     private graphemeAfter;
+    /** Delete one grapheme back, in whichever field owns the keyboard. */
     private backspace;
+    /** Delete one grapheme forward, in whichever field owns the keyboard. */
     private deleteAtCursor;
+    /** Move the caret one grapheme, in whichever field owns the keyboard. */
     private moveCursor;
     private historyBack;
     private historyForward;